Are you a member of the Splunk Community?
- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- Splunk Enterprise Security: How does ES determine ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We wonder how ES determines the license consumption.
After all, sometimes only few events from a certain index are classified as ES events by the TAs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @danielbb,
ES itself doesn't have it's own license consumption model.
Licensing depends on the DM's you are using and which indexes they are including. Total volume used by ES is the total volume of indexes used in it.
Cheers,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @danielbb,
ES itself doesn't have it's own license consumption model.
Licensing depends on the DM's you are using and which indexes they are including. Total volume used by ES is the total volume of indexes used in it.
Cheers,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok, but if the index used by the DM is only partially used, let's say, only 10% of the index is needed, how does it work?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah that can be an issue especially since most of the time you end up paying an ES license equal to your core license because it's assumed that "most of the volume will end up in ES anyway".
Best way to handle this problem is to talk to the sales rep and see at what point your "license" will cost you more. As it is now, the only thing the license does it allow you to get the ES installer and install it, doesn't limit your use of the application.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you @DavidHourani.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You're welcome @danielbb glad I could help 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ES does not measure its license consumption.
If this reply helps you, Karma would be appreciated.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
