Installation

License impact using load balancing

realsplunk
Motivator

Hello,

we have clustered indexers.

Could you confirm if the license usage is the same using these settings in the outputs.conf of universal forwarders :

[tcpout]
defaultGroup=indexer1,indexer2

[tcpout:indexer1]
server=10.1.1.197:9997

[tcpout:indexer2]
server=10.1.1.200:9997

I also noted it's possible to use this, however it may increase replication between indexers?

[tcpout:my_LB_indexers]
server=10.10.10.1:9997,10.10.10.2:9996,10.10.10.3:9995

Thanks a lot.

Labels (3)
0 Karma
1 Solution

adonio
Ultra Champion

Why will it effect licensing?
License counts against data indexed in the indexers and ... that's it!
it does not count against replication, internal data etc.
read more here:
https://docs.splunk.com/Documentation/Splunk/6.6.0/InheritedDeployment/Licensing
and here:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Admin/TypesofSplunklicenses
why will this configuration increase replication on indexers?
read more about outputs and forwarders load balancing here:
http://docs.splunk.com/Documentation/Forwarder/6.6.0/Forwarder/Configureforwardingwithoutputs.conf
hope it helps

View solution in original post

adonio
Ultra Champion

Why will it effect licensing?
License counts against data indexed in the indexers and ... that's it!
it does not count against replication, internal data etc.
read more here:
https://docs.splunk.com/Documentation/Splunk/6.6.0/InheritedDeployment/Licensing
and here:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Admin/TypesofSplunklicenses
why will this configuration increase replication on indexers?
read more about outputs and forwarders load balancing here:
http://docs.splunk.com/Documentation/Forwarder/6.6.0/Forwarder/Configureforwardingwithoutputs.conf
hope it helps

Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...