Splunk Enterprise

Additional license - SHC - Multisite (M4 / M14)

Nraj87
Loves-to-Learn Everything

In Distributed Clustered Deployment with SHC - Multisite (M4 / M14) model, is there any additional license required ?

Is there any downtime require while connection Site A with Site N with Multisite (M4 / M14)  model ?

 

Labels (1)
Tags (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

License requirements depend on your licensing model.

With an ingest-based license you only need a license based of the amount of data you're ingesting. It doesn't matter what your architecture is - you can do everything on an all-in-one setup (as long as it has enough capacity) or you can have a multisite cluster with dozens of indexers and search heads - all within the same license.

With a resource-based licensing your environment is licensed by processing capacity so more indexers-bigger license you need.

As this is not your first architecture/licensing-related question I will again advise you to consult your business needs with your local Splunk Partner - there might be other issues worth considering before choosing the final architecture.

Unless you're working for your local Splunk Partner wannabe - in such case ask your employer to invest in Architecting Splunk Environments training for you. 😉

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...