Installation

License Pool Question

maciep
Champion

We currently have one license pool that all of our indexers draw from. With a new initiative to get more people involved/introduced to Splunk using our test environment, we are thinking of creating a new test pool for that environment. The idea being that we protect our prod indexers from any accidental mishaps in the test environment - that test indexer will only be able to draw from the new test pool.

At the same time, though, we don't have a lot of licenses all together. So we might want to give our prod indexers the ability to draw from the test pool as well, if they need it.

I think I read that one indexer can draw from multiple pools. If that's the case, how is it decided which pool it will draw from? Essentially, I'd like the prod indexers to draw from the prod pool until it's empty, and only then start drawing from the test pool.

Would it work like that? Or maybe there's a better way? If not, we'll probably just keep the two pools completely separate.

Thanks!

Tags (2)
0 Karma
1 Solution

fbl_itcs
Path Finder

An indexer can only be in one license pool at the same time. Try to put one into a second one: It is greyed out.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Agree with fbl_itcs. Only 1 pool per indexer. Now on to an architectural answer.

Use a DEV License

Dev Licenses are FREE - 10GB/day for 6 months renewable. dev.splunk.com . There are a few ways the next steps could be done.

1. Apply DEV License to PROD license Manager
2. Create License Pool of 10GB
3. Point DEV indexers at PROD license Manager Assigned to DEV License Pool

OR

1. Standup a DEV License Manager (on an existing dev search head or a new one)
2. Apply DEV license to DEV License Manager
3. Point DEV indexers at DEV license Manager
4. Profit (not really, but the underpants gnomes think so.)

Be careful. Using Dev Licenses in Production (if assigned to a PROD indexer) might violate your terms and conditions. I'm NOT A LAWYER OR SPLUNK EMPLOYEE : USE THIS AT YOUR OWN RISK 😄

maciep
Champion

That's an interesting idea but I would run it by our Splunk contacts before trying it, because it seems a little too "easy". I have a feeling if you have a true test environment like we do, they'll probably want you to pay for the licenses.

0 Karma

fbl_itcs
Path Finder

Wow, thanks. I didn't knew there is a dev license available. Sounds great for a test enviroment.

Edit: Ok, as I read the T&C from dev.splunk.com it doesn't seems to fit into a test enviroment. The dev license is for app development only and not to test like new inputs etc. as far as I understand.

0 Karma

fbl_itcs
Path Finder

An indexer can only be in one license pool at the same time. Try to put one into a second one: It is greyed out.

maciep
Champion

That makes sense. It's too bad that we don't have a test master to test this stuff.

So it sounds like our internal question now will be whether the risk is higher for our test env to affect prod or for prod to run out if we give too many licenses to test.

0 Karma

fbl_itcs
Path Finder

That must be a special case:

I guess that if you put it into a newly created pool it will be removed from the auto generated pool.

What I see right now in one enviroment: All indexers are greyed out, because they are already in (non auto generated) pools, whey I click on "add pool" or "edit pool".

0 Karma

maciep
Champion

Oh ok, I must have misread that. When I went to create a new pool as a test (to see the options, etc), all of the indexers were available to add to it. But I didn't actually try to finish creating it though, so maybe it wouldn't have let me continue?

They are all in the auto generated pool right now which is configured for any indexer that connects.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...