Splunk SIEM Application

[rohitvjoshi]

Hi All,

We are using Splunk Enterprise, During server cleaning, We found out that Splunk Enterprise security is also there and it is disabled and no one is using from the last couple of years. We are looking for a few clarifications on Splunk Enterprise Security:

1. Do we need to purchase any additional license for Splunk Enterprise Essential?
2. Currently, Splunk Enterprise essential is in Disabled mode, does Splunk charge any cost for this?
3. If we have to remove this from our servers, do we need to take any extra care or directly we can remove this app from Deployer?

Thanks In Advance!

Happy Splunking 🙂

[lakshman239 · Accepted solution]

Splunk Enterprise security is a premium app, so you should have purchased it. Pls check with your splunk account/sales engineer.
Splunk Enterprise Essential is free and you can enable to see the use cases it has to tailor to your environment, or you can disable and remove it, via deployer.