Hi Splunkers, this might be a dumb question but I am a bit confused in regard to ITSI licensing.
I understand that ITSI requires an ingest of at least 50GB as well as a separate ITSI license in addition to the Splunk Core license. Does that mean a 50GB Core license and a 0GB ITSI license? Or could you get a 0GB Core license (like you would use on a HF that doesn't ingest anything) and a 50GB ITSI license?
And can both be installed in the same place in the GUI of the license master or is there a special process for the ITSI license?
You have to buy both, the core license and the itsi license. ITSI only works if you buy a license for it and a core license is also installed. That means in your example, 50GB core and 50GB ITSI. The ITSI license doesn't include core.