Splunk Enterprise Security

Splunk Enterprise Security: How does ES determine license consumption?

danielbb
Motivator

We wonder how ES determines the license consumption.
After all, sometimes only few events from a certain index are classified as ES events by the TAs.

1 Solution

DavidHourani
Super Champion

Hi @danielbb,

ES itself doesn't have it's own license consumption model.

Licensing depends on the DM's you are using and which indexes they are including. Total volume used by ES is the total volume of indexes used in it.

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @danielbb,

ES itself doesn't have it's own license consumption model.

Licensing depends on the DM's you are using and which indexes they are including. Total volume used by ES is the total volume of indexes used in it.

Cheers,
David

danielbb
Motivator

Ok, but if the index used by the DM is only partially used, let's say, only 10% of the index is needed, how does it work?

0 Karma

DavidHourani
Super Champion

Yeah that can be an issue especially since most of the time you end up paying an ES license equal to your core license because it's assumed that "most of the volume will end up in ES anyway".

Best way to handle this problem is to talk to the sales rep and see at what point your "license" will cost you more. As it is now, the only thing the license does it allow you to get the ES installer and install it, doesn't limit your use of the application.

0 Karma

danielbb
Motivator

Thank you @DavidHourani.

0 Karma

DavidHourani
Super Champion

You're welcome @danielbb glad I could help 🙂

0 Karma

richgalloway
SplunkTrust
SplunkTrust

ES does not measure its license consumption.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...