We currently have one license pool that all of our indexers draw from. With a new initiative to get more people involved/introduced to Splunk using our test environment, we are thinking of creating a new test pool for that environment. The idea being that we protect our prod indexers from any accidental mishaps in the test environment - that test indexer will only be able to draw from the new test pool.
At the same time, though, we don't have a lot of licenses all together. So we might want to give our prod indexers the ability to draw from the test pool as well, if they need it.
I think I read that one indexer can draw from multiple pools. If that's the case, how is it decided which pool it will draw from? Essentially, I'd like the prod indexers to draw from the prod pool until it's empty, and only then start drawing from the test pool.
Would it work like that? Or maybe there's a better way? If not, we'll probably just keep the two pools completely separate.
Agree with fbl_itcs. Only 1 pool per indexer. Now on to an architectural answer.
Use a DEV License
Dev Licenses are FREE - 10GB/day for 6 months renewable. dev.splunk.com . There are a few ways the next steps could be done.
1. Apply DEV License to PROD license Manager 2. Create License Pool of 10GB 3. Point DEV indexers at PROD license Manager Assigned to DEV License Pool
1. Standup a DEV License Manager (on an existing dev search head or a new one) 2. Apply DEV license to DEV License Manager 3. Point DEV indexers at DEV license Manager 4. Profit (not really, but the underpants gnomes think so.)
Be careful. Using Dev Licenses in Production (if assigned to a PROD indexer) might violate your terms and conditions. I'm NOT A LAWYER OR SPLUNK EMPLOYEE : USE THIS AT YOUR OWN RISK 😄
That's an interesting idea but I would run it by our Splunk contacts before trying it, because it seems a little too "easy". I have a feeling if you have a true test environment like we do, they'll probably want you to pay for the licenses.
Wow, thanks. I didn't knew there is a dev license available. Sounds great for a test enviroment.
Edit: Ok, as I read the T&C from dev.splunk.com it doesn't seems to fit into a test enviroment. The dev license is for app development only and not to test like new inputs etc. as far as I understand.
That makes sense. It's too bad that we don't have a test master to test this stuff.
So it sounds like our internal question now will be whether the risk is higher for our test env to affect prod or for prod to run out if we give too many licenses to test.
That must be a special case:
I guess that if you put it into a newly created pool it will be removed from the auto generated pool.
What I see right now in one enviroment: All indexers are greyed out, because they are already in (non auto generated) pools, whey I click on "add pool" or "edit pool".
Oh ok, I must have misread that. When I went to create a new pool as a test (to see the options, etc), all of the indexers were available to add to it. But I didn't actually try to finish creating it though, so maybe it wouldn't have let me continue?
They are all in the auto generated pool right now which is configured for any indexer that connects.