Hello,
Apologies as this has probably been asked before. With the Splunk vCPU licensing is the license per cluster or VM. For example if you have a 24 vCPU license is this the CPU usage allowance for the whole cluster or 24 vCPU per VM?
The total vCPU count across all Splunk Enterprise count towards the vCPU licensed capacity. If you have a 24 vCPU license, this means that the combined total of vCPUs assigned to all your Splunk Enterprise instances should not exceed 24. This is not a per-VM allocation but an aggregate limit across your deployment.
please refer to Splunk's official documentation on How Splunk Enterprise licensing works - Splunk Documentation
https://www.splunk.com/en_us/legal/licensed-capacity.html?locale=en_us
https://docs.splunk.com/Documentation/Splunk/9.4.0/Admin/TypesofSplunklicenses
https://conf.splunk.com/files/2020/slides/PLA1520C.pdf