What does an Enterprise license get me?

[mctester]

Hi,

We have support for our product, but I do not have enough information about our license. What we are entitled, how many server(s)/receivers we can run, how many we can install a forwarders vs light forwarders?

Thank you,

[Mick · Accepted solution]

Hi there, you must be new to the world of Splunk, welcome!

With your Enterprise license, you should have received a 'Welcome to Enterprise Support' document that should answer a lot of questions, I'll make sure to send a copy on to you.

You can split your license across as many indexing servers as you want, but that's really only beneficial when you get up into moderate to high indexing loads, 100GB per day and above. Check out this deployment guide for sizing info

Forwarders and Light Forwarders are really a configuration mode of a standard Splunk instance. They are pretty easy and straightforward to set up in a simple configuration, but they can get complicated when you start having specific data requirements. If the documentation here doesn't answer all of your questions, then likely what you need is some Q&A time with a Splunk techie to answer all of your questions. I also strongly recommend that you attend some of the Splunk Education classes. You should speak to your Account Rep about both of these possibilities.

[muebel · Accepted solution]

From "license comparison" in splunk.com search

Splunk licenses Splunk offers two basic kinds of licenses: Free, and Enterprise.

Splunk Free is a totally free (as in beer) version of Splunk. It allows you to index up to 500MB/day and will never expire. Splunk Free is designed for personal, ad-hoc search and visualization of IT data. It entitles you to 500MB/day of licensing volume. It does not support the features listed below for Splunk Enterprise.

Splunk Enterprise supports multiple user accounts and role-based access controls, distributed search, forwarding in TCP/HTTP formats (you can forward data to other Splunk instances, but not to non-Splunk instances), deployment management, scheduled saved searches (including summary indexing) and alerting/monitoring. About Splunk licenses - from Documentation More about Splunk Free - from Documentation

How Splunk licensing works

More About Splunk Free

[Mick · Accepted solution]

Hi there, you must be new to the world of Splunk, welcome!

With your Enterprise license, you should have received a 'Welcome to Enterprise Support' document that should answer a lot of questions, I'll make sure to send a copy on to you.

You can split your license across as many indexing servers as you want, but that's really only beneficial when you get up into moderate to high indexing loads, 100GB per day and above. Check out this deployment guide for sizing info

Forwarders and Light Forwarders are really a configuration mode of a standard Splunk instance. They are pretty easy and straightforward to set up in a simple configuration, but they can get complicated when you start having specific data requirements. If the documentation here doesn't answer all of your questions, then likely what you need is some Q&A time with a Splunk techie to answer all of your questions. I also strongly recommend that you attend some of the Splunk Education classes. You should speak to your Account Rep about both of these possibilities.