Splunk licensing question

[OldManEd]

Is there any way I can create a stand-alone Splunk instance using another instance’s license?

I would like to create a full featured, stand-alone Splunk development system consisting of one search head and one indexer. I’m not concerned about the forwarder. I could use the Splunk ~free~ license, but I would really like this development environment to have all the features of the existing ones, (i.e., Alarming).

Paying for more licenses is not in the books. We do have 2 existing Splunk instances here with extra capacity. What I would like to do is use the extra capacity from one of those for my development instance. Is this possible?

[thellmann]

I realise this question is quite old, but for those viewing this answer today I would recommend getting a developer license:

10GB Developer licenses are available to everyone and can be requested using this form: https://dev.splunk.com/enterprise/dev_license - the approval process is manually and we will typically be able to process requests within 2-3 days. If you haven't received your license within this time, please reach out to devinfo@splunk.com

50GB Personalized Dev/Test licenses are available to users associated with accounts with a paid Splunk Enterprise or Splunk Cloud license of any size and can be requested here: https://splunk.com/dev-test - the approval process is automated, so if you encounter any issues please reach out to your Splunk sales representative.

[martin_mueller · Accepted solution]

Sure. Set up the new instance as a license slave connected to the instance having your current license. They exchange spent volume regularly, just make sure the slave gets a connection at least once per 24 hours.

http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Configurealicenseslave

[martin_mueller]

If you have more pools than just the autogenerated one then yeah, you need to configure your indexers into pools... without a pool they don't have assigned license volume.

Not quite sure about the warning, check if that disappears by tomorrow as license-related warnings (pool warning in this case) are on a per-day basis.

[OldManEd]

Martin,

OK, problem here with this configuration. When I logged in to the server acting as the license manager this morning, there were warning messages telling me that “Daily indexing volume exceeded for 2 slaves.” I found out that I needed to create a “pool” and place my test environment servers in the pool. So I did that.

Then I restarted the master license server Splunk instance and the messages disappeared. But as soon as I started the Splunk test environment Splunk instance, the messages came back. Is this ~normal~ operation for Splunk?

[OldManEd]

OK, great. And thanks again.

[martin_mueller]

Typically every non-forwarder instance will be license slave to the license master.

If the search head doesn't have access to a Splunk Enterprise license, there won't be any alerting or user authentication running on the search head.

[OldManEd]

One question, do I set up the search head as a slave also?

[OldManEd]

Cool, and thanks.