Splunk Enterprise

What is 0 MB License?

dataIngester
Explorer

Hi,

I would like to know more about what a zero MB / zero byte License is. What is included and what is not, in this type of license. What are the pros and cons of using such a license in a Production Environment will be?

In our set-up we currently have a single instance Deployment Server (Search Head), Indexer, some UF's and a HF. It was proposed to link only the Indexer to our License Master and have the other splunk servers operate on a zero MB license.

Will having such an architecture set-up for the licensing have an adverse affect on utilizing the full potential of Splunk Enterprise Features for the Deployment Server/Search Head, Heavy Forwarder? (I believe that it wouldn't impact much for the Universal Forwarder).

More information on zero MB License would be appreciated.

Thanks, 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

A zero MB license specifies the features the licensed instance can use, but does not add to the indexing quota.  It is typically used on Heavy Forwarders so they can function in a distributed environment.

No, a zero MB license will not have an adverse effect on utilizing the full potential of Splunk - exactly the opposite is true.

Universal Forwarders do not need a license.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

A zero MB license specifies the features the licensed instance can use, but does not add to the indexing quota.  It is typically used on Heavy Forwarders so they can function in a distributed environment.

No, a zero MB license will not have an adverse effect on utilizing the full potential of Splunk - exactly the opposite is true.

Universal Forwarders do not need a license.

---
If this reply helps you, Karma would be appreciated.

dataIngester
Explorer

@richgalloway : Thanks a lot for the information. Appreciate it. 😉

0 Karma

isoutamo
SplunkTrust
SplunkTrust

As @richgalloway  already said this license is for features not for indexing. One reason for it is use it with DS as it needs those features, but normally it’s not indexing. Especially when DS is topological in a place where it cannot contact to LM this kind of license is mandatory.

r. Ismo

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...