Installation

Multiple licenses, violation warnings and search lockout.

hanoc
Engager

We are planning to split up our environments into different licenses.

My questions are:

  1. should we have a violation on an individual license does that add to a global or individual (to the license) violation total.

  2. What will be the effect should we have 5 violations (within the rolling window) on a single license. Search blackout on that license or globally.

The use case I really want to avoid is e.g. 5 violations from different licenses causing a global search blackout or 5 violations on a lower priority license (from our perspective, e.g. dev environment) causing a global search blackout.

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

It all depends on how you stack the licenses. If you have a single license master with all the licenses installed, and carved up, a global blackout would be caused by 5 violations. If you have multiple license masters, then you would have individual license blackouts. You can also get a reset license rather quickly if you need it. I would also suggest a "Dev license" (10GB) for use in your Dev Environment. That way you don't have to worry about dev impacting prod.

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

It all depends on how you stack the licenses. If you have a single license master with all the licenses installed, and carved up, a global blackout would be caused by 5 violations. If you have multiple license masters, then you would have individual license blackouts. You can also get a reset license rather quickly if you need it. I would also suggest a "Dev license" (10GB) for use in your Dev Environment. That way you don't have to worry about dev impacting prod.

hanoc
Engager

Great advice, thank you. I will be standing up some new license masters very shortly.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...