Installation

Multiple licenses, violation warnings and search lockout.

hanoc
Engager

We are planning to split up our environments into different licenses.

My questions are:

  1. should we have a violation on an individual license does that add to a global or individual (to the license) violation total.

  2. What will be the effect should we have 5 violations (within the rolling window) on a single license. Search blackout on that license or globally.

The use case I really want to avoid is e.g. 5 violations from different licenses causing a global search blackout or 5 violations on a lower priority license (from our perspective, e.g. dev environment) causing a global search blackout.

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

It all depends on how you stack the licenses. If you have a single license master with all the licenses installed, and carved up, a global blackout would be caused by 5 violations. If you have multiple license masters, then you would have individual license blackouts. You can also get a reset license rather quickly if you need it. I would also suggest a "Dev license" (10GB) for use in your Dev Environment. That way you don't have to worry about dev impacting prod.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

It all depends on how you stack the licenses. If you have a single license master with all the licenses installed, and carved up, a global blackout would be caused by 5 violations. If you have multiple license masters, then you would have individual license blackouts. You can also get a reset license rather quickly if you need it. I would also suggest a "Dev license" (10GB) for use in your Dev Environment. That way you don't have to worry about dev impacting prod.

hanoc
Engager

Great advice, thank you. I will be standing up some new license masters very shortly.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...