Installation

Multiple licenses, violation warnings and search lockout.

Engager

We are planning to split up our environments into different licenses.

My questions are:

  1. should we have a violation on an individual license does that add to a global or individual (to the license) violation total.

  2. What will be the effect should we have 5 violations (within the rolling window) on a single license. Search blackout on that license or globally.

The use case I really want to avoid is e.g. 5 violations from different licenses causing a global search blackout or 5 violations on a lower priority license (from our perspective, e.g. dev environment) causing a global search blackout.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

It all depends on how you stack the licenses. If you have a single license master with all the licenses installed, and carved up, a global blackout would be caused by 5 violations. If you have multiple license masters, then you would have individual license blackouts. You can also get a reset license rather quickly if you need it. I would also suggest a "Dev license" (10GB) for use in your Dev Environment. That way you don't have to worry about dev impacting prod.

View solution in original post

SplunkTrust
SplunkTrust

It all depends on how you stack the licenses. If you have a single license master with all the licenses installed, and carved up, a global blackout would be caused by 5 violations. If you have multiple license masters, then you would have individual license blackouts. You can also get a reset license rather quickly if you need it. I would also suggest a "Dev license" (10GB) for use in your Dev Environment. That way you don't have to worry about dev impacting prod.

View solution in original post

Engager

Great advice, thank you. I will be standing up some new license masters very shortly.

0 Karma